Synthetic adversarial patches: First, we create synthetic robust feature level adversarial patches as in [1]} by perturbing the latent activations of a BigGAN [2]} generator.
The synthetic adversarial patches were trained to cause any source class image to be misclassified as the target regardless of the insertion location in the source image.
